Thousands Are Googling 'Return to Kroll' to Check If Their Letter Is a Scam. It's the Envelope's Return Address — and the Code Inside Has an Expiration Date

Search data shows a surge of people typing the exact phrase 'return to kroll' into Google in the first days of August — hundreds of searches in a week, from zero before. The reason sits in the top-left corner of an envelope. The official notification template for the Unlimited Technology Systems breach — the mail-merge master file that generates every letter, posted publicly by an affected provider — shows the printed return-address block begins with the literal line «Return to Kroll», followed by Kroll's mailing address.

In other words: 'Return to Kroll' is not an instruction, a claim step, or a company you owe anything to. It is how Kroll Settlement Administration — the identity-monitoring firm hired for this breach — identifies itself as the sender. Recipients who have never heard of Kroll (or of Unlimited) are googling the envelope to find out whether it is junk mail or a scam. It is neither.

Unlimited Technology Systems, LLC is a practice-management software vendor used by healthcare organizations — cancer centers, hematology-oncology practices and other providers. Its own notice says intruders were in its commercial data center between October 5 and October 10, 2025, and the activity was discovered on October 19, 2025. Letters only began going out on July 20–21, 2026 — roughly nine months later. First-class mail takes one to two weeks to arrive, which is why envelopes are being opened, and googled, right now.

The notice lists the exposed data categories: health insurance and patient balance information, medical information such as record numbers, dates of service and diagnosis information, scanned documents such as driver's licenses and insurance cards, Social Security numbers, and contact details. It also states what was not involved: full medical records, medical imaging, and financial information such as credit card or bank account numbers. State attorney-general filings show hundreds of thousands of affected patients across at least four states — including 277,364 in Texas and 162,478 in Iowa alone.

Everything official in this matter runs through exactly two channels, both printed in the genuine letter:

The hotline is (844) 576-3063 — staffed Monday through Friday, 9:00 a.m. to 6:30 p.m. Eastern. That is Unlimited's dedicated breach-response line. It is also being googled directly (people check phone numbers before calling back — a good instinct).

The enrollment site is enroll.krollmonitoring.com/redeem — where you activate 24 months of free credit monitoring, fraud consultation and identity-restoration help using the activation code and verification ID printed in your letter. Note the detail most people miss: the letter states your activation code stops working after the activation deadline printed in your copy. If you set the letter aside, the free monitoring quietly expires with it.

Anything else — a caller asking for your Social Security number 'to verify your settlement,' a website with a claim form, a fee to 'release your payment' — is not part of this process. Kroll administers several current healthcare breach notifications (DentaQuest's recent notices are a separate matter with its own paperwork), so check the case name on your letter before acting on anything.

There is no settlement fund, no claim form and no payout in the Unlimited matter. What exists so far is early-stage litigation: proposed class actions were filed in the U.S. District Court for the Southern District of Ohio on July 22 and July 24, 2026 (the second, Matlock v. Unlimited Technology Systems, LLC, No. 1:26-cv-00729, is assigned to Judge Matthew W. McFarland), followed by a motion on July 26 to consolidate the cases and appoint interim class counsel.

If those cases ever produce a settlement, notices would come from a court-appointed administrator with a case number you can verify — likely years from now, not weeks. Until then, the only thing with a real deadline is the free monitoring code in your letter. Activate it, keep the letter itself (it is your proof of being in the affected population if a settlement class is ever certified), and treat any 'Unlimited settlement claim' website you find today as a red flag.